openstack-k8s-operators · centosinfra-prod-github-app · Aug 12, 2026 · Jul 10, 2026
diff --git a/automation/mocks/bgp_dt05.yaml b/automation/mocks/bgp_dt05.yaml
diff --git a/automation/vars/bgp_dt05.yaml b/automation/vars/bgp_dt05.yaml
@@ -0,0 +1,200 @@
+---
+vas:
+  bgp_dt05:
+    stages:
+      - pre_stage_run:
+          - name: 01 Apply taint on worker-3
+            type: cr
+            definition:
+              spec:
+                taints:
+                  - effect: NoSchedule
+                    key: testOperator
+                    value: 'true'
+                  - effect: NoExecute
+                    key: testOperator
+                    value: 'true'
+            kind: Node
+            resource_name: worker-3
+            state: patched
+          - name: 02 Disable rp_filters on OCP nodes
+            type: cr
+            definition:
+              spec:
+                profile:
+                  - data: |
+                      [main]
+                      summary=Optimize systems running OpenShift (provider specific parent profile)
+                      include=-provider-${f:exec:cat:/var/lib/ocp-tuned/provider},openshift
+
+                      [sysctl]
+                      net.ipv4.conf.enp7s0.rp_filter=0
+                      net.ipv4.conf.enp8s0.rp_filter=0
+                    name: openshift-no-reapply-sysctl
+                recommend:
+                  - match:
+                      # applied to all nodes except worker-3, because worker-3 has no enp8s0
+                      - label: kubernetes.io/hostname
+                        value: worker-0
+                      - label: kubernetes.io/hostname
+                        value: worker-1
+                      - label: kubernetes.io/hostname
+                        value: worker-2
+                      - label: node-role.kubernetes.io/master
+                    operand:
+                      tunedConfig:
+                        reapply_sysctl: false
+                    priority: 15
+                    profile: openshift-no-reapply-sysctl
+            api_version: tuned.openshift.io/v1
+            kind: Tuned
+            resource_name: openshift-no-reapply-sysctl
+            namespace: openshift-cluster-node-tuning-operator
+            state: present
+        name: nncp-configuration
+        path: examples/dt/bgp_dt05/control-plane/networking/nncp
+        wait_conditions:
+          - >-
+            oc -n openstack wait nncp
+            -l osp/nncm-config-type=standard
+            --for jsonpath='{.status.conditions[0].reason}'=SuccessfullyConfigured
+            --timeout=300s
+        values:
+          - name: network-values
+            src_file: values.yaml
+        build_output: nncp.yaml
+
+      - name: networking
+        path: examples/dt/bgp_dt05/control-plane/networking
+        wait_conditions:
+          - >-
+            oc -n metallb-system wait pod
+            -l app=metallb -l component=speaker
+            --for condition=Ready
+        values:
+          - name: network-values
+            src_file: nncp/values.yaml
+        build_output: networking.yaml
+
+      - name: control-plane
+        path: examples/dt/bgp_dt05/control-plane
+        wait_conditions:
+          - >-
+            oc -n openstack wait openstackcontrolplane
+            controlplane
+            --for condition=Ready
+            --timeout=30m
+        values:
+          - name: network-values
+            src_file: networking/nncp/values.yaml
+          - name: service-values
+            src_file: service-values.yaml
+        build_output: control-plane.yaml
+        post_stage_run:
+          - name: Create BGPConfiguration after controlplane is deployed
+            type: cr
+            definition:
+              spec: {}
+            api_version: network.openstack.org/v1beta1
+            kind: BGPConfiguration
+            resource_name: bgpconfiguration
+            namespace: openstack
+            state: present
+
+      - name: edpm-computes-r0-nodeset
+        path: examples/dt/bgp_dt05/edpm/computes/r0
+        wait_conditions:
+          - >-
+            oc -n openstack wait openstackdataplanenodeset
+            r0-compute-nodes
+            --for condition=SetupReady
+            --timeout=600s
+        values:
+          - name: edpm-r0-compute-nodeset-values
+            src_file: values.yaml
+        build_output: edpm-r0-compute-nodeset.yaml
+
+      - name: edpm-computes-r1-nodeset
+        path: examples/dt/bgp_dt05/edpm/computes/r1
+        wait_conditions:
+          - >-
+            oc -n openstack wait openstackdataplanenodeset
+            r1-compute-nodes
+            --for condition=SetupReady
+            --timeout=600s
+        values:
+          - name: edpm-r1-compute-nodeset-values
+            src_file: values.yaml
+        build_output: edpm-r1-compute-nodeset.yaml
+
+      - name: edpm-computes-r2-nodeset
+        path: examples/dt/bgp_dt05/edpm/computes/r2
+        wait_conditions:
+          - >-
+            oc -n openstack wait openstackdataplanenodeset
+            r2-compute-nodes
+            --for condition=SetupReady
+            --timeout=600s
+        values:
+          - name: edpm-r2-compute-nodeset-values
+            src_file: values.yaml
+        build_output: edpm-r2-compute-nodeset.yaml
+
+      - name: edpm-networkers-r0-nodeset
+        path: examples/dt/bgp_dt05/edpm/networkers/r0
+        wait_conditions:
+          - >-
+            oc -n openstack wait openstackdataplanenodeset
+            r0-networker-nodes
+            --for condition=SetupReady
+            --timeout=600s
+        values:
+          - name: edpm-r0-networker-nodeset-values
+            src_file: values.yaml
+        build_output: edpm-r0-networker-nodeset.yaml
+
+      - name: edpm-networkers-r1-nodeset
+        path: examples/dt/bgp_dt05/edpm/networkers/r1
+        wait_conditions:
+          - >-
+            oc -n openstack wait openstackdataplanenodeset
+            r1-networker-nodes
+            --for condition=SetupReady
+            --timeout=600s
+        values:
+          - name: edpm-r1-networker-nodeset-values
+            src_file: values.yaml
+        build_output: edpm-r1-networker-nodeset.yaml
+
+      - name: edpm-networkers-r2-nodeset
+        path: examples/dt/bgp_dt05/edpm/networkers/r2
+        wait_conditions:
+          - >-
+            oc -n openstack wait openstackdataplanenodeset
+            r2-networker-nodes
+            --for condition=SetupReady
+            --timeout=600s
+        values:
+          - name: edpm-r2-networker-nodeset-values
+            src_file: values.yaml
+        build_output: edpm-r2-networker-nodeset.yaml
+
+      - name: edpm-deployment
+        path: examples/dt/bgp_dt05/edpm/deployment
+        wait_conditions:
+          - >-
+            oc -n openstack wait openstackdataplanedeployment
+            edpm-deployment
+            --for condition=Ready
+            --timeout=120m
+        values:
+          - name: edpm-deployment-values
+            src_file: values.yaml
+        build_output: edpm-deployment.yaml
+        post_stage_run:
+          - name: Wait until computes are ready
+            type: playbook
+            source: "nova_wait_for_compute_service.yml"
+            extra_vars:
+              _number_of_computes: 3
+              _cell_conductor: nova-cell0-conductor-0
diff --git a/examples/dt/bgp_dt05/README.md b/examples/dt/bgp_dt05/README.md
@@ -0,0 +1,149 @@
+# RHOSO Deployed Topology - BGP DT05 - EVPN with hybrid iBGP/eBGP
+
+This document describes BGP Deployed Topology DT05, used to test L2VPN EVPN
+with a hybrid BGP fabric on Red Hat OpenStack Services on OpenShift (RHOSO).
+
+The CRs included within this DT should be applied on an environment where EDPM
+and OCP nodes are connected through a spine/leaf network. The BGP protocol
+should be enabled on those spine and leaf routers.
+
+## Purpose
+
+This BGP DT (DT05) reuses the bgp_dt01 rack topology and tests EVPN-oriented
+BGP configuration:
+
+* Neutron API configured with the `evpn` service_plugin at the control plane
+* FRR on dataplane nodes as AS **65000** with `remote-as internal` (iBGP to leafs)
+* L2VPN EVPN address-family enabled on FRR (`advertise-all-vni`)
+* OVN Agent configured with the `ovn-evpn` extension on computes and networkers
+* MetalLB BGP peers using `myASN`/`peerASN` **65000** (iBGP to leaf routers)
+
+### BGP ASN layout
+
+| Role | ASN | Session type |
+| ---- | --- | ------------ |
+| EDPM compute / networker FRR | 65000 | iBGP to leafs |
+| MetalLB speakers (OCP workers) | 65000 | iBGP to leafs |
+| Leaf routers | 65000 | iBGP to EDPM/OCP; eBGP to spines |
+| Spine routers | 64999 | eBGP to leafs; iBGP to router-0 |
+| External router (router-0) | 64999 | iBGP to spines |
+
+Leaf↔EDPM and leaf↔MetalLB stay iBGP on AS **65000**. Spine↔leaf is **eBGP**
+so uplink and downlink routes are different BGP path types (avoids double
+route-reflector ECMP loops in a single-AS fabric).
+
+In CI, leaf/spine/router-0 FRR is rendered by ci-framework
+`prepare-bgp-spines-leaves` using `cifmw_bgp_*` vars from the
+`ci-framework-jobs` `bgp_dt05` scenario. When changing ASN layout, open
+linked PRs and use `Depends-On:` so Zuul tests architecture and jobs together.
+
+Compared to [bgp_dt01](../bgp_dt01/), which uses `ovn-bgp` and dataplane ASN
+64999, DT05 targets the EVPN agent path where neutron-ovn-agent dynamically
+extends `router bgp 65000` for EVPN advertisement.
+
+The OCP cluster consists of the following nodes:
+
+* 3 OCP master nodes
+* 3 OCP worker nodes
+* 1 OCP worker node with special configuration (OCP tester node)
+
+This DT creates an OCP cluster that includes both master and worker nodes,
+instead of the usual master/worker combo nodes. The reason for this is to run
+disruptive tests only on the OCP workers, which host the OpenStack Control
+Plane services, avoiding potential issues when OCP master nodes are disrupted
+that would not be relevant when testing RHOSO high availability scenarios.
+
+The extra OCP worker (OCP tester) is needed to run tests from it because:
+
+* disruptive tests can be run from this worker on the other workers without
+  affecting the test execution
+* this worker is connected to the spine/leaf routers with a special routing
+  configuration, so that it can reach the OpenStack provider network
+
+The OCP tester is configured so that only test pods (created by the
+OpenStack test-operator) run on it.
+
+This DT configures both compute and networker EDPM nodes. Networker
+nodes are needed when BGP is used on RHOSO, in order to expose routes to SNAT
+traffic (OVN Gateway IPs). In other words, when RHOSO is used with BGP, the OCP
+workers cannot be configured as OVN Gateways.
+
+The OCP and EDPM nodes deployed with this DT are distributed into three
+different racks. Each rack is connected to two leaves.
+Hence, the distribution of the nodes in the racks is the following one:
+
+* rack0: r0-compute-0, r0-networker-0, ocp-master-0, ocp-worker-0, leaf-0, leaf-1
+* rack1: r1-compute-0, r1-networker-0, ocp-master-1, ocp-worker-1, leaf-2, leaf-3
+* rack2: r2-compute-0, r2-networker-0, ocp-master-2, ocp-worker-2, leaf-4, leaf-5
+
+The OCP tester (ocp-worker-3) is not included into any rack. It is not
+connected to any leaves, but to a router connected to the spines, due to the
+reasons described before (it needs special connectivity to reach the provider
+network).
+
+## Node topology
+
+| Node role               | bm/vm | amount |
+| ----------------------- | ----- | ------ |
+| Openshift master nodes  | vm    | 3      |
+| Openshift worker nodes  | vm    | 4      |
+| Openstack Computes      | vm    | 3      |
+| Openstack Networker     | vm    | 3      |
+| Leaf routers            | vm    | 6      |
+| Spine routers           | vm    | 2      |
+| External routers        | vm    | 1      |
+| Ansible Controller      | vm    | 1      |
+
+### Networks
+
+| Name                     | Type     | CIDR             |
+| ------------------------ | -------- | ---------------- |
+| Controlplane rack0       | untagged | 192.168.122.0/24 |
+| Controlplane rack1       | untagged | 192.168.123.0/24 |
+| Controlplane rack2       | untagged | 192.168.124.0/24 |
+| Provider network         | untagged | 192.168.133.0/24 |
+| RH OSP                   | untagged | 192.168.111.0/24 |
+| edpm/ocp to left leaves  | untagged | 100.64.x.y/30    |
+| edpm/ocp to right leaves | untagged | 100.65.x.y/30    |
+
+## Services, enabled features and configurations
+
+| Service          | configuration    | Lock-in coverage?  |
+| ---------------- | ---------------- | ------------------ |
+| Glance           | Swift            | Must have          |
+| Swift            | (default)        | Must have          |
+| Heat             | (default)        | Must have          |
+| frr              | dataplane (iBGP AS 65000 to leafs, L2VPN EVPN) | Must have |
+| neutron-ovn      | dataplane (`ovn-evpn`) | Must have    |
+
+## Considerations/Constraints
+
+1. Virtual networks should be created to connect the nodes to the routers.
+2. Lab routers must match the hybrid ASN layout: leafs AS **65000**;
+   spines and router-0 AS **64999**, with eBGP on spine↔leaf links. In CI this
+   is set via `cifmw_bgp_*` in the `ci-framework-jobs` `bgp_dt05` scenario.
+3. The spine/leaf topology separates the nodes into different L2
+   network segments, called racks. Each rack includes two leaves, some OCP
+   nodes and some EDPM nodes.
+4. The OpenStack services running on the EDPM nodes are installed using the BGP
+   network, i.e. the OpenStack services running on OCP nodes connect to the
+   OpenStack services running on EDPM nodes using BGP. There is no direct L2
+   network connectivity between them. OCP version 4.18 or higher is required
+   because the OpenStack Operators use the frr-k8s feature for this and frr-k8s
+   is not available in OCP 4.16.
+5. Once OpenStack is installed on them, both dataplane and controlplane
+   connections are achieved using the BGP protocol.
+6. Tests are executed from the OCP worker to verify external connectivity.
+
+## Stages
+
+All stages must be executed in the order listed below. Everything is required
+unless otherwise indicated.
+
+1. [Configure taints on the OCP worker](../bgp_dt01/configure-taints.md)
+2. [Disable RP filters on OCP nodes](../bgp_dt01/disable-rp-filters.md)
+3. [Install the OpenStack K8S operators and their dependencies](../../../common/)
+4. [Apply metallb customization required to run a speaker pod on the OCP tester node](metallb/)
+5. [Configuring networking and deploy the OpenStack control plane](control-plane.md)
+6. [Create BGPConfiguration after controlplane is deployed](../bgp_dt01/bgp-configuration.md)
+7. [Configure and deploy the dataplane - networker and compute nodes](data-plane.md)